HIPAA MANUAL Whole Child Pediatrics

Transcription

1

2 HIPAA MANUAL HIPAA Manual Table of Contents 1.General a. Abbreviated Notice of Privacy Practices Framed for Reception Area b. Notice of Privacy Practices 6 pages to printer c. Training Agenda d. Privacy Officer Job Description 2. Policies a. Confidentiality b. Patient Access to the Medical Record c. Authorization Form Policy d. Minimum Necessary Disclosure e. Privacy Complaint f. Non-Authorized Disclosures g. Medical Record Amendment h. Restriction of Use or Disclosure of PHI 3. Forms a. Consent (front desk) b. Confidentiality and Non-Disclosure (for employees) c. Patient Access to Medical Records Request (secretary) d. Privacy Complaint e. Accounting of Non-authorized f. Medical Record Amendment g. Restriction of Use Abbreviated Notice of Privacy Practices Our practice is committed to maintaining the privacy of your Protected Health Information (PHI), while providing high quality medical care. In accordance with the HIPAA regulations you will receive a full written Notice of our privacy practices at your first office visit after July 19th, This notice will explain: How we may use and disclose your PHI. Your privacy rights regarding your PHI. Our obligations concerning the use and disclosure of your PHI.

3 We may use and disclose your PHI for Treatment, Payment, and health care Operations (TPO) as well as other times in order to provide you with excellent service. You have the right to inspect, copy, and amend your PHI. You have the right to request restrictions on the use of your PHI. You have the right to an accounting of the disclosures of our PHI for other than TPO. You have the right to complain about alleged violation to this practice s privacy officer and the U.S. Department of Health and Human Services. You will receive a full Notice of Privacy Practices (NPP). Please read it and if you have questions, please feel free to meet with our privacy officer for clarification or assistance. Notice of Privacy Practices This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. If you have any questions about this Notice please contact: our Privacy Officer who is Dr. Marc Drummond. This Notice of Privacy Practices describes how we may use and disclose your protected health information to carry out treatment, payment or health care operations and for other purposes that are permitted or required by law. It also describes your rights to access and control your protected health information. Protected Health Information (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. We are required to abide by the terms of this Notice of Privacy Practices. We may change the terms of our notice, at any time. The new notice will be effective for all protected health information that we maintain at that time. Upon your request, we will provide you with any revised Notice of Privacy Practices by calling the office and requesting that a revised copy be sent to you in the mail or asking for one at the time of your next appointment. 1. Uses and Disclosures of Protected Health Information Uses and Disclosures of Protected Health Information Based Upon Your Written Consent You will be asked by your physician to sign a consent form. Once you have consented to use and disclosure of your protected health information for treatment, payment and health care operations by signing the consent form, your physician will use or disclose your protected health information as described in this Section 1. Your protected health information may be used and disclosed by your physician, our office staff and others outside of our office that are involved in your care and treatment for the purpose of providing health care services to you. Your protected health information may also be used and disclosed to pay your health care bills and to support the operation of the physician s practice. Following are examples of the types of uses and disclosures of your protected health care information that the physician s office is permitted to make once you have signed our consent form. These examples are not meant to be exhaustive, but to describe the types of uses and disclosures that may be made by our office once you have provided consent.

4 Treatment: We will use and disclose your protected health information to provide, coordinate, or manage your health care and any related services. This includes the coordination or management of your health care with a third party that has already obtained your permission to have access to your protected health information. For example, we would disclose your protected health information, as necessary, to a home health agency that provides care to you. We will also disclose protected health information to other physicians who may be treating you when we have the necessary permission from you to disclose your protected health information. For example, your protected health information may be provided to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you. In addition, we may disclose your protected health information from time-to-time to another physician or health care provider (e.g., a specialist or laboratory) who, at the request of your physician, becomes involved in your care by providing assistance with your health care diagnosis or treatment to your physician. Payment: Your protected health information will be used, as needed, to obtain payment for your health care services. This may include certain activities that your health insurance plan may undertake before it approves or pays for the health care services we recommend for you such as; making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities. For example, obtaining approval for a hospital stay may require that your relevant protected health information be disclosed to the health plan to obtain approval for the hospital admission. Healthcare Operations: We may use or disclose, as-needed, your protected health information in order to support the business activities of your physician s practice. These activities include, but are not limited to, quality assessment activities, employee review activities, training of medical students, licensing, marketing and fundraising activities, and conducting or arranging for other business activities. For example, we may disclose your protected health information to medical school students that see patients at our office. In addition, we may use a sign-in sheet at the registration desk where you will be asked to sign your name and indicate your physician. We may also call you by name in the waiting room when your physician is ready to see you. We may use or disclose your protected health information, as necessary, to contact you to remind you of your appointment. We will share your protected health information with third party business associates that perform various activities (e.g., billing, accounting) for the practice. Whenever an arrangement between our office and a business associate involves the use or disclosure of your protected health information, we will have a written contract that contains terms that will protect the privacy of your protected health information. We may use or disclose your protected health information, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also use and disclose your protected health information for other marketing activities. For example, your name and address may be used to send you a newsletter about our practice and the services we offer. We may also send you information about products or services that we believe may be beneficial to you. You may contact our Privacy Contact to request that these materials not be sent to you. We may use or disclose your demographic information and the dates that you received treatment from your physician, as necessary, in order to contact you for fundraising activities supported by our office. If you do not want to receive these materials, please contact our Privacy Contact and request that these fundraising materials not be sent to you. Uses and Disclosures of Protected Health Information Based upon Your Written

5 Authorization Other uses and disclosures of your protected health information will be made only with your written authorization, unless otherwise permitted or required by law as described below. You may revoke this authorization, at any time, in writing, except to the extent that your physician or the physician s practice has taken an action in reliance on the use or disclosure indicated in the authorization. Other Permitted and Required Uses and Disclosures That May Be Made With Your Consent, Authorization or Opportunity to Object We may use and disclose your protected health information in the following instances. You have the opportunity to agree or object to the use or disclosure of all or part of your protected health information. If you are not present or able to agree or object to the use or disclosure of the protected health information, then your physician may, using professional judgment, determine whether the disclosure is in your best interest. In this case, only the protected health information that is relevant to your health care will be disclosed. Others Involved in Your Healthcare: Unless you object, we may disclose to a member of your family, a relative, a close friend or any other person you identify, your protected health information that directly relates to that person s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary if we determine that it is in your best interest based on our professional judgment. We may use or disclose protected health information to notify or assist in notifying a family member, personal representative or any other person that is responsible for your care of your location, general condition or death. Finally, we may use or disclose your protected health information to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care. Emergencies: We may use or disclose your protected health information in an emergency treatment situation. If this happens, your physician shall try to obtain your consent as soon as reasonably practicable after the delivery of treatment. If your physician or another physician in the practice is required by law to treat you and the physician has attempted to obtain your consent but is unable to obtain your consent, he or she may still use or disclose your protected health information to treat you. Communication Barriers: We may use and disclose your protected health information if your physician or another physician in the practice attempts to obtain consent from you but is unable to do so due to substantial communication barriers and the physician determines, using professional judgment, that you intend to consent to use or disclosure under the circumstances. Other Permitted and Required Uses and Disclosures That May Be Made Without Your Consent, Authorization or Opportunity to Object We may use or disclose your protected health information in the following situations without your consent or authorization. These situations include: Required By Law: We may use or disclose your protected health information to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures. Public Health: We may disclose your protected health information for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury or disability. We may also disclose your protected health information, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.

6 Communicable Diseases: We may disclose your protected health information, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition. Health Oversight: We may disclose protected health information to a health oversight agency for activities authorized by law, such as audits, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws. Abuse or Neglect: We may disclose your protected health information to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your protected health information if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws. Food and Drug Administration: We may disclose your protected health information to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, track products; to enable product recalls; to make repairs or replacements, or to conduct post marketing surveillance, as required. Legal Proceedings: We may disclose protected health information in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process. Law Enforcement: We may also disclose protected health information, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include (1) legal processes and otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of the practice, and (6) medical emergency (not on the Practice s premises) and it is likely that a crime has occurred. Coroners, Funeral Directors, and Organ Donation: We may disclose protected health information to a coroner or medical examiner for identification purposes, determining cause of death or for the coroner or medical examiner to perform other duties authorized by law. We may also disclose protected health information to a funeral director, as authorized by law, in order to permit the funeral director to carry out their duties. We may disclose such information in reasonable anticipation of death. Protected health information may be used and disclosed for cadaver organ, eye or tissue donation purposes. Research: We may disclose your protected health information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your protected health information. Criminal Activity: Consistent with applicable federal and state laws, we may disclose your protected health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual. Military Activity and National Security: When the appropriate conditions apply, we may use or disclose protected health information of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs

7 of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military services. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized. Workers Compensation: Your protected health information may be disclosed by us as authorized to comply with workers compensation laws and other similar legally established programs. Inmates: We may use or disclose your protected health information if you are an inmate of a correctional facility and your physician created or received your protected health information in the course of providing care to you. Required Uses and Disclosures: Under the law, we must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of Section et. seq. 2. Your Rights Following is a statement of your rights with respect to your protected health information and a brief description of how you may exercise these rights. You have the right to inspect and copy your protected health information. This means you may inspect and obtain a copy of protected health information about you that is contained in a designated record set for as long as we maintain the protected health information. A designated record set contains medical and billing records and any other records that your physician and the practice use for making decisions about you. Under federal law, however, you may not inspect or copy the following records; Psychotherapy notes; information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding, and protected health information that is subject to law that prohibits access to protected health information. Depending on the circumstances, a decision to deny access may be reviewable. In some circumstances, you may have a right to have this decision reviewed. Please contact our Privacy Contact if you have questions about access to your medical record. You have the right to request a restriction of your protected health information. This means you may ask us not to use or disclose any part of your protected health information for the purposes of treatment, payment or healthcare operations. You may also request that any part of your protected health information not be disclosed to family members or friends who may be involved in your care or for notification purposes as described in this Notice of Privacy Practices. Your request must state the specific restriction requested and to whom you want the restriction to apply. Your physician is not required to agree to a restriction that you may request. If physician believes it is in your best interest to permit use and disclosure of your protected health information, your protected health information will not be restricted. If your physician does agree to the requested restriction, we may not use or disclose your protected health information in violation of that restriction unless it is needed to provide emergency treatment. With this in mind, please discuss any restriction you wish to request with your physician. You may request a restriction by requesting the Form Restriction of Use. You have the right to request to receive confidential communications from us by alternative means or at an alternative location. We will accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not request an explanation from you as to the basis for the request. Please make this request in writing to our Privacy Officer. You may have the right to have your physician amend your protected health information. This means you may

8 request an amendment of protected health information about you in a designated record set for as long as we maintain this information. In certain cases, we may deny your request for an amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of any such rebuttal. Please contact our Privacy Officer to determine if you have questions about amending your medical record. You have the right to receive an accounting of certain disclosures we have made, if any, of your protected health information. This right applies to disclosures for purposes other than treatment, payment or healthcare operations as described in this Notice of Privacy Practices. It excludes disclosures we may have made to you, to family members or friends involved in your care, or for notification purposes. You have the right to receive specific information regarding these disclosures that occurred after July 19, You may request a shorter timeframe. The right to receive this information is subject to certain exceptions, restrictions and limitations. You have the right to obtain a paper copy of this notice from us, upon request, even if you have agreed to accept this notice electronically. 3. Complaints You may complain to us or to the Secretary of Health and Human Services if you believe your privacy rights have been violated by us. You may file a complaint with us by notifying our privacy contact of your complaint. We will not retaliate against you for filing a complaint. You may contact our Privacy Officer, Marc Drummond, Psy. D. at for further information about the complaint process. This notice was published and becomes effective on July 19, HIPAA Training Agenda What is HIPAA and how does it apply to this office? Introduction of privacy officer and explanation of role. Explanation of policies and forms: Notice of Privacy Practices (NPP) Authorization for release of protected health information (PHI) Patient amendment of the medical record Patient access to the medical record Required uses and disclosures of PHI: Non-authorized disclosures Incidental uses and disclosures Patient privacy complaint Explanation of minimum necessary standard Sign confidentiality agreement. Date of training: Employees attending: Person providing training: Privacy Officer Job Description

9 Position Title: Privacy Officer Immediate Supervisor: Marc Drummond, General Purpose: The privacy officer oversees all ongoing activities related to the development, implementation, maintenance of, and adherence to the organization s policies and procedures covering the privacy of, and access to, patient health information in compliance with federal and state laws and the healthcare organization s information privacy practices. Responsibilities: Provides development guidance and assists in the identification, implementation, and maintenance of organization information privacy policies and procedures in coordination with organization management, administration, and legal counsel. Performs initial and periodic information privacy risk assessments and conducts related ongoing compliance monitoring activities in coordination with the entity s other compliance and operational assessment functions. Works with legal counsel and management, key departments, and committees to ensure the organization has and maintains appropriate privacy and confidentiality consent, authorization forms, and information notices and materials reflecting current organization and legal practices and requirements. Oversees, directs, delivers, or ensures delivery of initial and privacy training and orientation to all employees, volunteers, medical and professional staff, contractors, alliances, business associates, and other appropriate third parties Participates in the development, implementation, and ongoing compliance monitoring of all trading partner and business associate agreements, to ensure all privacy concerns, requirements, and responsibilities are addressed. Establishes with management and operations a mechanism to track access to protected health information, within the purview of the organization and as required by law and to allow qualified individuals to review or receive a report on such activity. Works cooperatively with the staff in overseeing patient rights to inspect, amend, and restrict access to protected health information when appropriate. Establishes and administers a process for receiving, documenting, tracking, investigating, and taking action on all complaints concerning the organization s privacy policies and procedures in coordination and collaboration with other similar functions and, when necessary, legal counsel. Ensures compliance with privacy practices and consistent application of sanctions for failure to comply with privacy policies for all individuals in the organization s workforce, extended workforce, and for all business associates. Initiates, facilitates and promotes activities to foster information privacy awareness within the organization and related entities. Reviews all system-related information security plans throughout the organization s network to ensure alignment between security and privacy practices Works with all organization personnel involved with any aspect of release of protected health information, to ensure full coordination and cooperation under the organization s policies and procedures and legal requirements Maintains current knowledge of applicable federal and state privacy laws and accreditation standards, and monitors advancements in information privacy technologies to ensure organizational adaptation and compliance. Serves as information privacy consultant to the organization for all departments and appropriate entities. Cooperates with the Office of Civil Rights, other legal entities, and organization officers in any compliance reviews or investigations.

10 Works with organization administration, legal counsel, and other related parties to represent the organization s information privacy interests with external parties (state or local government bodies) who undertake to adopt or amend privacy legislation, regulation, or standard. Confidentiality Policy Effective date of policy: July 19, 2012 All employees, staff, contractors, and agents of our practice will be trained to respect the health care information of our practice. They will treat all medical, personal, biometric, and financial information as confidential. All employees, staff, contractors, and agents of our practice will receive confidentiality training and sign confidentiality agreements annually. Any person who breaches this trust will be disciplined and risks immediate termination. Patient Access to the Medical Record Policy Effective date of policy: July 19, 2012 Patients have the right to inspect and receive copies of their medical records. This practice may charge for the copying of the record, as well as supplies, labor, and postage, and the patient should be notified of this cost in advance. The patient should agree to this financial responsibility in writing, in advance. (See form.) This practice has the right to deny a patient s request to inspect and copy their medical record. This denial must be in writing and explain why the request has been denied. There are several circumstances when the denial may not be appealed (unreviewable denial). Psychotherapy notes. Information compiled in reasonable anticipation of or for use in a civil, criminal, or administrative action proceeding. Protected health information (PHI) maintained by a practice subject to Clinical Laboratory Improvements Amendments (CLIA) (to the extent access to an individual would be prohibited by law). Correctional facility can deny part or total access. In research situations. If the information was obtained from someone other than a health care provider and if access would compromise an individual providing information under a promise of confidentiality. The patient can appeal the denial and has the right to request review by another licensed health professional designated by the practice and who was not a part of the original decision to deny access (reviewable denial). If a licensed health care professional determines that the requested access would endanger the life or physical safety of the individual or another person. If the record makes reference to another person and the licensed health professional believes the access could cause substantial harm to that person. Request has been made by patient s personal representative and the licensed professional believes it could cause harm to that individual or another person. Patients should make this request on the attached form, which is then submitted to the privacy officer for action.

11 Authorization Form Policy Effective date of policy: July 19, 2012 Medical records will only be released from our practice with a properly executed authorization from the patient or his/her personal representative, except for treatment, payment, or health care operations (TPO) and as otherwise required by law. Minimum Necessary Disclosure Policy Effective date of policy: July 19, 2012 When protected health information (PHI) is released from this office, reasonable efforts will be made to assure that only the minimum amount of information needed to satisfy the request will be released. Professional judgment will determine the amount of information to be released. The minimum necessary standard is not intended to impede the provision of quality health care. Disclosures of PHI between providers for treatment purposes are explicitly exempt from this standard. Privacy Complaint Policy Effective date of policy: July 19, 2012 Patients have the right to file a formal complaint if they feel we have not adequately protected their privacy. This complaint must be submitted in writing to the privacy officer or may be submitted directly to the U.S. Department of Health and Human Services Secretary. The complaint must be submitted within 180 days of the event of concern. The privacy officer is responsible for the investigation and resolution of the complaint. The practice must maintain a record of the complaints and the resolution, if applicable, for six (6) years. Non-Authorized Disclosures Policy Effective date of policy: July 19, 2012 Protected health information (PHI) may be disclosed without patient authorization in certain circumstances. These include but are not limited to: Public health authority, The FDA The medical examiner or coroner after a patient has died As authorized by state or federal law If this practice makes a non-authorized disclosure, it will keep a log of these disclosures for six (6) years. A patient may request, in writing, an accounting of any non-authorized disclosures of his PHI. The patient is allowed one accounting per year at no charge. If a patient requests frequent disclosures, this practice may charge for this service, PROVIDED he is informed of the approximate charge in advance and agrees to it. Medical Record Amendment Policy Policy effective date: July 19, 2012 Any patient may request that his/her medical record be changed, corrected, or amended. This request must be in writing and must include the reason for the desired change, amendment, or correction. This practice may accept or deny this request and will inform the patient in writing of the decision within 60 days. One 30-day extension is permitted if

12 the patient is notified of the reason for the delay. If the request is denied, the practice must give a reason for denying the request. Requests will be retained for six (6) years and must be included in future releases of the patient s protected health information (PHI). If the amendment request has been denied, this denial letter must also be included in future PHI disclosures. Requests for amendment of medical records should be submitted to the privacy officer for action. Restriction of Use or Disclosure of Protected Health Information (PHI) Policy Effective date of policy: July 19, 2012: A patient has the right to REQUEST that the use and disclosure of his protected health information (PHI) be restricted for treatment, payment, and health care operations (TPO), as well as restricting disclosure to only certain people, such as certain family members only. THIS PRACTICE DOES NOT HAVE TO AGREE TO YOUR REQUEST. The restriction request must be in writing, be specific as to what information is covered by the request, whether it covers use, disclosure, or both, and to whom these limitations apply. If this practice agrees to the request, it will honor the request except when overriding laws or emergencies apply. Consent Form Patient: Physician: I have received a copy of the Institutes Notice of Privacy Policy. In connection with the medical services that I am receiving from the above named physician or physician group, I hereby authorize the above-named physician and or group to disclose any or all information concerning my medical condition and treatment, including copies of applicable hospital and medical records, to: A. Any third party payor covering the medical services of the patient; B. Other health care professionals and institutions involved in the delivery of health care to the patient; C. The proponent of any legally sufficient subpoena, or in response to a court order; D. Employees and agents of the practice, to the degree necessary to facilitate the provision of health care services and payment for such services; E. Pharmacies; and F. Other parties as otherwise required by law. In each case, the practice shall take reasonable steps to ensure that only the minimum necessary information is disclosed in accordance with the above. This consent is valid from the date executed until revoked in writing by myself. Signed: Date: Confidentiality and Non-Disclosure Agreement I,, do affirm that I will not divulge DATA TO ANY UNAUTHORIZED PERSON FOR ANY REASON. Neither will I directly nor indirectly use, or allow the use of Whole Child Peditrics data for any purpose other than that directly associated with my official assigned duties. I understand that ALL PATIENT INFORMATION, including financial data, is strictly confidential.

13 Furthermore, I will not, either by direct action or by counsel, discuss, recommend, or suggest to any unauthorized person the nature or content of any information. Violation of confidentiality is cause for disciplinary action, including immediate dismissal. I understand that signing this document does not preclude me from reporting instances of breach of confidentiality. Signed Date Patient Consent Form By signing this form, you are granting consent to. to use and disclose your protected health information for the purposes of treatment, payment and health care operations. Our Notice of Privacy Practices provides more detailed information about how we may use and disclose this protected health information. You have a legal right to review our Notice of Privacy Practices before you sign this consent, and we encourage you to read it in full. Our Notice of Privacy Practices is subject to change. If we change our notice, you may obtain a copy of the revised notice by written request to: 1949 S. Bridge Street, Yorkville, Illinois You have a right to request us to restrict how we use and disclose your protected health information for the purposes of treatment, payment or health care operations. We are not required by law to grant your request. However, if we do decide to grant your request, we are bound by our agreement. You have the right to revoke this consent in writing, except to the extent we already have used or disclosed your protected health information in reliance on your consent. Signature: Date: Patient Access to the Medical Record Request Form I,, request to make copies of my medical records for my personal inspection. I understand that these records contain protected health information (PHI). I agree to be responsible for the cost of copying these records, including copying fees, labor, supplies, and postage (if applicable). Our policy has always been, and will continue to be, to provide the medical record at the first request at no charge to the patient. Should additional requests be made the charge for this will be $25.00 and $0.15 per page for each page in excess of the first 20 pages and I will be charged a minimum of $ I agree to pay for this prior to the service being rendered. Patient Signature Date of request Privacy Complaint Form I,, would like to make a complaint about the privacy practices and/or procedures The following is my statement: (Please include specific details such as specific personnel involved and the date and location of the event of concern to you.) Signature of patient: Date:

14 Accounting of Non-Authorized Use or Disclosure Request Form I,, request that Whole Child Pediatrics provide me with an accounting of any and all non-authorized uses and disclosures of my protected health information (PHI) since (date). I understand that I may be charged for this information if I have previously requested this information within the last 12 months. I have been informed of the approximate cost of $10.00, and agree to be financially responsible for this charge. Patient signature: Date: Privacy Officer Action/Comments: Medical Record Amendment Request Form I,, request that Whole child Pediatrics change/amend my medical record because: (Explain what is to be changed/amended and why.) For my medical record to be more complete/accurate, it should say: Patient signature: Date of request: Practice Response: Accept change Deny change with explanation: Signature of provider/physician: Date: Restriction of Use or Disclosure of Protected Health Information (PHI) Form I,, request that restrict the use or disclosure of my to. Patient Signature: Date: Privacy Officer Comments: Accept this request. Reject this request. Patient contacted / /